EXECUT~1.EXE
Sources: 300M+ executions observed in the wild.
Summary
Short filename (8.3 format) for an executable, likely from a management or deployment tool using legacy path conventions.
EXECUT~1.EXE is the 153rd most commonly executed Windows program in EchoTrail's dataset, observed 109,412 times across enterprise environments. It typically runs from C:\... and it is most often launched by ClusterInfo.exe.
Get this in your tools
The same record for execut~1.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/execut~1.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\...100%
Top Hashes (SHA256)
- 68810bf6e96c9c4b04deba20c12aef21aca23132f48421cfb10348ce9dc774aa57.45%
- 2237391b5c957e2607b65f5538e8befa257c1d9f82a94fd666a67e12f0af675942.55%
Process Ancestry
Top Parents
- svchost.exe50%
Top Children
- powershell.exe50.01%
- zscccon64.exe49.99%
Security Analysis
What does EXECUT~1.EXE normally do?
Part of Unknown software.
When is EXECUT~1.EXE suspicious?
Running from unexpected paths.
How do attackers abuse EXECUT~1.EXE?
Not commonly abused.
Detection guidance
No specific detection needed.
False positive notes
Normal operation.
Ask Rocky about EXECUT~1.EXE
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for EXECUT~1.EXE. The free tier returns the summary, 500 lookups a month. Or ask Rocky.